Dependency Upgrades - OpenHands Docs

Keeping dependencies up to date is essential for security, performance, and access to new features. OpenHands can help you identify outdated dependencies, plan upgrades, handle breaking changes, and validate that your application still works after updates.

Overview

OpenHands helps with dependency management by:

Analyzing dependencies: Identifying outdated packages and their versions
Planning upgrades: Creating upgrade strategies and migration guides
Implementing changes: Updating code to handle breaking changes
Validating results: Running tests and verifying functionality

Dependency Analysis Examples

Identifying Outdated Dependencies

Start by understanding your current dependency state:

Analyze the dependencies in this project and create a report:

List all direct dependencies with current and latest versions
Identify dependencies more than 2 major versions behind
Flag any dependencies with known security vulnerabilities
Highlight dependencies that are deprecated or unmaintained
Prioritize which updates are most important

Example output:

Package	Current	Latest	Risk	Priority
lodash	4.17.15	4.17.21	Security (CVE)	High
react	16.8.0	18.2.0	Outdated	Medium
express	4.17.1	4.18.2	Minor update	Low
moment	2.29.1	2.29.4	Deprecated	Medium

Dependency upgrades are often needed to fix security vulnerabilities in your dependencies. If you’re upgrading dependencies specifically to address security issues, see our Vulnerability Remediation guide for comprehensive guidance on:

Automating vulnerability detection and remediation
Integrating with security scanners (Snyk, Dependabot, CodeQL)
Building automated pipelines for security fixes
Using OpenHands agents to create pull requests automatically

Compatibility Checking

Check for compatibility issues before upgrading:

Check compatibility for upgrading React from 16 to 18:

Review our codebase for deprecated React patterns
List all components using lifecycle methods
Identify usage of string refs or findDOMNode
Check third-party library compatibility with React 18
Estimate the effort required for migration

Compatibility matrix:

Dependency	React 16	React 17	React 18	Action Needed
react-router	v5 ✓	v5 ✓	v6 required	Major upgrade
styled-components	v5 ✓	v5 ✓	v5 ✓	None
material-ui	v4 ✓	v4 ✓	v5 required	Major upgrade

Automated Upgrade Examples

Version Updates

Perform straightforward version updates:

Node.js
Python
Java

Update all patch and minor versions in package.json:

Review each update for changelog notes
Update package.json with new versions
Update package-lock.json
Run the test suite
List any deprecation warnings

Update dependencies in requirements.txt:

Check each package for updates
Update requirements.txt with compatible versions
Update requirements-dev.txt similarly
Run tests and verify functionality
Note any deprecation warnings

Update dependencies in pom.xml:

Check for newer versions of each dependency
Update version numbers in pom.xml
Run mvn dependency:tree to check conflicts
Run the test suite
Document any API changes encountered

Breaking Change Handling

When major versions introduce breaking changes:

Upgrade axios from v0.x to v1.x and handle breaking changes:

1. List all breaking changes in axios 1.0 changelog
2. Find all axios usages in our codebase
3. For each breaking change:
   - Show current code
   - Show updated code
   - Explain the change
4. Create a git commit for each logical change
5. Verify all tests pass

Example transformation:

// Before (axios 0.x)
import axios from 'axios';
axios.defaults.baseURL = 'https://api.example.com';
const response = await axios.get('/users', {
  cancelToken: source.token
});

// After (axios 1.x)
import axios from 'axios';
axios.defaults.baseURL = 'https://api.example.com';
const controller = new AbortController();
const response = await axios.get('/users', {
  signal: controller.signal
});

Code Adaptation

Adapt code to new API patterns:

Migrate our codebase from moment.js to date-fns:

List all moment.js usages in our code
Map moment methods to date-fns equivalents
Update imports throughout the codebase
Handle any edge cases where APIs differ
Remove moment.js from dependencies
Verify all date handling still works correctly

Migration map:

moment.js	date-fns	Notes
`moment()`	`new Date()`	Different return type
`moment().format('YYYY-MM-DD')`	`format(new Date(), 'yyyy-MM-dd')`	Different format tokens
`moment().add(1, 'days')`	`addDays(new Date(), 1)`	Function-based API
`moment().startOf('month')`	`startOfMonth(new Date())`	Separate function

Testing and Validation Examples

Automated Test Execution

Run comprehensive tests after upgrades:

After the dependency upgrades, validate the application:

Run the full test suite (unit, integration, e2e)
Check test coverage hasn't decreased
Run type checking (if applicable)
Run linting with new lint rule versions
Build the application for production
Report any failures with analysis

Integration Testing

Verify integrations still work:

Test our integrations after upgrading the AWS SDK:

Test S3 operations (upload, download, list)
Test DynamoDB operations (CRUD)
Test Lambda invocations
Test SQS send/receive
Compare behavior to before the upgrade
Note any subtle differences

Regression Detection

Detect regressions from upgrades:

Check for regressions after upgrading the ORM:

Run database operation benchmarks
Compare query performance before and after
Verify all migrations still work
Check for any N+1 queries introduced
Validate data integrity in test database
Document any behavioral changes

Additional Examples

Security-Driven Upgrade

We have a critical security vulnerability in jsonwebtoken.

Current: jsonwebtoken@8.5.1
Required: jsonwebtoken@9.0.0

Perform the upgrade:
1. Check for breaking changes in v9
2. Find all usages of jsonwebtoken in our code
3. Update any deprecated methods
4. Update the package version
5. Verify all JWT operations work
6. Run security tests

Framework Major Upgrade

Upgrade our Next.js application from 12 to 14:

Key areas to address:
1. App Router migration (pages -> app)
2. New metadata API
3. Server Components by default
4. New Image component
5. Route handlers replacing API routes

For each area:
- Show current implementation
- Show new implementation
- Test the changes

Multi-Package Coordinated Upgrade

Upgrade our React ecosystem packages together:

Current:
- react: 17.0.2
- react-dom: 17.0.2
- react-router-dom: 5.3.0
- @testing-library/react: 12.1.2

Target:
- react: 18.2.0
- react-dom: 18.2.0
- react-router-dom: 6.x
- @testing-library/react: 14.x

Create an upgrade plan that handles all these together,
addressing breaking changes in the correct order.

Vulnerability Remediation - Fix security vulnerabilities
Security Guide - Security best practices for AI agents
Prompting Best Practices - Write effective prompts

Use Cases

​Overview

​Dependency Analysis Examples

​Identifying Outdated Dependencies

​Security-Related Dependency Upgrades

​Compatibility Checking

​Automated Upgrade Examples

​Version Updates

​Breaking Change Handling

​Code Adaptation

​Testing and Validation Examples

​Automated Test Execution

​Integration Testing

​Regression Detection

​Additional Examples

​Security-Driven Upgrade

​Framework Major Upgrade

​Multi-Package Coordinated Upgrade

​Related Resources